Randy Dunlap fed8b8f33a tty: hvc_iucv: fix off-by-one in number of supported devices ...

[ Upstream commit f2a880e802 ]

MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8.
This is the number of entries in:
  static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];

Sometimes hvc_iucv_table[] is limited by:
(a)	if (num > hvc_iucv_devices) // for error detection
or
(b)	for (i = 0; i < hvc_iucv_devices; i++) // in 2 places
(so these 2 don't agree; second one appears to be correct to me.)

hvc_iucv_devices can be 0..8. This is a counter.
(c)	if (hvc_iucv_devices > MAX_HVC_IUCV_LINES)

If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8].
Oops.

Fixes: 44a01d5ba8 ("[S390] s390/hvc_console: z/VM IUCV hypervisor console support")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260130072939.1535869-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-05-23 13:03:20 +02:00

..

hvc

tty: hvc_iucv: fix off-by-one in number of supported devices

2026-05-23 13:03:20 +02:00

ipwireless

…

serdev

…

serial

serial: uartlite: fix PM runtime usage count underflow on probe

2026-03-25 11:06:04 +01:00

vt

…

amiserial.c

…

ehv_bytechan.c

…

goldfish.c

…

Kconfig

…

Makefile

…

mips_ejtag_fdc.c

…

moxa.c

…

mxser.c

…

n_gsm.c

…

n_hdlc.c

…

n_null.c

…

n_tty.c

…

nozomi.c

…

pty.c

…

rpmsg_tty.c

…

synclink_gt.c

…

sysrq.c

…

tty_audit.c

…

tty_baudrate.c

…

tty_buffer.c

…

tty_io.c

…

tty_ioctl.c

…

tty_jobctrl.c

…

tty_ldisc.c

…

tty_ldsem.c

…

tty_mutex.c

…

tty_port.c

…

tty.h

…

ttynull.c

…

vcc.c

…